Information disclosure in Firefox ESR - CVE-2017-7764

Vulnerability identifier: #VU7075

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7764

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The weakness exists due to mix of characters from the "Canadian Syllabics" unicode block  with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form. A remote attacker can use characters confusion to perform domain name spoofing attacks and read arbitrary files.

Successful exploitation of the vulnerability results in information disclosure.

Firefox ESR
Mozilla Firefox
Arch Linux
Gentoo Linux
Debian Linux
SUSE Linux
Ubuntu
Opensuse
Mozilla Thunderbird

Update to version 52.2.

Firefox ESR - update to 52.2.0
Mozilla Firefox - update to 54.0
Mozilla Thunderbird - update to 52.2

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• openSUSE update for Mozilla
• Ubuntu update for Thunderbird
• SUSE Linux update for MozillaFirefox
• Arch Linux update for thunderbird
• Arch Linux update for firefox
• Ubuntu update for Firefox
• Debian update for firefox-esr
• Debian update for icedove
• Gentoo update for Mozilla Firefox
• SUSE Linux update for MozillaFirefox
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Multiple vulnerabilities in Mozilla Firefox